Skip to content
OpenAdvisories
Medium VA-26-197-01 1 CVE

remorses/genql code injection

Published Jul 16, 2026 · Updated Jul 16, 2026

Vendor: remorses Product: genql

Summary

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported.

Vulnerabilities 1

  • Medium 6.4
    CVE-2026-63397

    remorses/genql code injection

    remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when th…

    remorses genql @genql/cli npm

Revision history

  1. #1.0.0

    Initial publication